Skip to content

Crashes in DoH requests (consistent, unknown cause) #6604

Closed
@arvids-kokins-bidstack

Description

@arvids-kokins-bidstack

OS: Windows (probably doesn't matter though)
libcurl version: 7.65.2-DEV (based on 40259ca with minor changes)

call stack:

  • Curl_strncasecompare(const char * first, const char * second, unsigned __int64 max) Line 139
    • while(*first && *second && max) { -- first is an invalid value
  • Curl_checkheaders(const connectdata * conn, const char * thisheader) Line 101
    • data->set.headers head seems to point to wrong memory (dangling pointer?) but often the memory is still usable enough to crash a bit deeper
    • conn->ip_addr_str = "1.1.1.1"
    • conn->connection_id = 18 (from one of the dumps, some are higher) so it's not a guaranteed failure
  • Curl_http(connectdata * conn, bool * done) Line 2082
    • path = "/dns-query"
    • host = "1.1.1.1"
  • multi_do(Curl_easy *) Line 1214
  • multi_runsingle(Curl_multi * multi, curltime now, Curl_easy * data) Line 1585
  • curl_multi_perform(Curl_multi * multi, int * running_handles) Line 2094

sadly the minidump does not include the entire connectdata or Curl_easy data structures (they seem to be too big) but feel free to ask for any data early in the structure, I may be able to provide some

I've also noticed one possibly related issue that is marked as a known bug: #4592

2 questions:

  • is there a path in the state machine which would restart/reuse the DoH request after it calls doh_done?
    • I've tried using a proxy (set using env.var.) but ran into some other bugs which were fixed according to changelog
    • also tried redirects but those didn't seem to help either
  • why are DoH request headers freed in doh_done separately, before freeing the request handles? this seems to be true even in the latest version: https://github.com/curl/curl/blob/master/lib/doh.c#L200

this seems to be a relatively rare issue but I'd still like to at least understand what's causing it since it's difficult to reproduce

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions